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ABSTRACT : 

A system and method are disclosed for real-time insertion of data into a 
multi -dimensional database. The system includes a multi-dimensional database and a 
user interface operable to access and provide views into the multi -dimensional 
database. A data insertion engine is coupled to and operable to access the 
multi-dimensional database. The data insertion engine is further operable to receive 
and process a real-time data feed and to insert data into the multi -dimensional 
database responsive to processing of the real-time data feed. In one embodiment, the 
real-time data feed can represent exploited network vulnerabilities, and the system 
can be used for network intrusion detection and vulnerability assessment. The method 
includes receiving a real-time data feed representing detection of an event and 
processing the event against the multi -dimensional database. Cells associated with 
the event are identified in the multi -dimensional database and appropriate vectors 
to the identified cells are created. Data representing the event is then inserted at 
the identified cells. Visibility to the inserted data is provided through a user 
interface to the multi -dimensional database. In one embodiment, the event can be an 
exploited network vulnerability, and the method can be used for intrusion detection 
and vulnerability assessment. 
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"Gentia Software, Section 3: Query and Reporting Tools", by META Group, Inc., Data 
Warehousing Tools Bulletin (Aug. 1997); pp., 3615-3620. 

ART-UNIT: 2743 

PRIMARY- EXAMINER : Kuntz; Curtis 
ASSISTANT -EXAMINER: Barnie; Rexford N 

ABSTRACT : 

Specialized telecom network users who burden the network, such as Internet Service 
Providers (ISPs), are identified by analysis of network traffic data to identify 
addresses (e.g. telephone numbers) for destinations receiving unique patterns of 
incoming traffic. For an ISP, in particular, the analysis involves identifying 
telephone, numbers of destinations receiving a high volume of calls and having 
connections exhibiting a long average hold time. To further enhance the ISP finder 
analysis, the call data may be examined to confirm that there is no outgoing call 
traffic from any station associated with the candidate ISP numbers. When numbers are 
identified by the call data analysis, a technician can call each number and listen 
for a modem tone, as a confirmation that each candidate number actually is of a data 
service such as an ISP. Similar methodologies can identify destination numbers for 
other unique service providers, such as credit card verification services The 
preferred embodiments utilize automated systems to compile and analyze call records 
from standard messages of a telephone network, such as interoffice signaling 
messages or automated accounting messages. 
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ABSTRACT 



A monitoring system capture, ^^n^P-cesses messages^rom SS7 ^^cojpile call 

dSta ^Honaf database Automatic Menage Accounting (AMA) records also are 
acSSSaSf-nf fpSdef £ -ther re ational database^ data p^ 
operation enhances the records for further ^cessing^ Tnis^at p useful forms, 
operation involves translating info ^"E " ^ored ord into mo dafca 
uling external reference data regarding the -^ored networ^ Fo^ ^ ^ 
preparation translates SS7 point coaea or data Dreparation also spreads the 

names of originating and terminating of time to predefined 
usage information from the recoras co p ™» * ± stage is to form one or more 

goaded to an on-line analytical processing application. 
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2 271/902 

2 341/23 
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3 235/376 
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15 235/383 (6 OR, 9 XR) 

Class 235 : REGISTERS 

235/375 SYSTEMS CONTROLLED BY DATA BEARING RECORDS 

235/383 .Mechanized store 

12 235/375 (4 OR, 8 XR) 

Class 235 : REGISTERS 

235/375 SYSTEMS CONTROLLED BY DATA BEARING RECORDS 

10 235/380 (2 OR, 8 XR) 

Class 235 : REGISTERS 

235/375 SYSTEMS CONTROLLED BY DATA BEARING RECORDS 

235/380 .Credit or identification card systems 

7 235/487 (1 OR, 6 XR) 

Class 235 : REGISTERS 
235/487 RECORDS 

7 379/114.14 (5 OR, 2 XR) 

Class 379 : TELEPHONIC COMMUNICATIONS 

379/111 WITH USAGE MEASUREMENT (E.G., CALL OR TRAFFIC 

REGISTER) 

379/114.01 .Call charge metering or monitoring 
379/114.14 ..Fraud detection or control 

7 705/14 (4 OR, 3 XR) 

Class 705 : DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/PRICE DETERMIN 

AT I ON 

705/1 AUTOMATED ELECTRICAL FINANCIAL OR BUSINESS 

PRACTICE OR MANAGEMENT ARRANGEMENT 
705/14 .Distribution or redemption of coupon, or 

incentive or promotion program 

6 235/385 (2 OR, 4 XR) 

Class 235 : REGISTERS 

235/375 SYSTEMS CONTROLLED BY DATA BEARING RECORDS 

235/385 .Inventory 

5 235/379 (1 OR, 4 XR) 

Class 235 : REGISTERS 

235/375 SYSTEMS CONTROLLED BY DATA BEARING RECORDS 

235/379 .Banking systems 
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235/432 (0 OR, 5 XR) 

Class 235 : REGISTERS 

235/419 RECORD CONTROLLED CALCULATORS 

235/432 .With printing 

179/267 (0 OR, 5 XR) 

riaq* 379 ' TELEPHONIC COMMUNICATIONS 

379/242 ' CENTRALIZED SWITCHING SYSTEM 

379/258 .Switching controlled in response to called 

station addressing signal 
379/260 .-With operator position or completion of call 

(e.g., dial "0", semiautomatic) 
379/267 ...Operator's console 

186/61 (2 OR, 2 XR) 

Class 186 : MERCHANDISING 

185 /35 CUSTOMER SERVICE 

186/52 .Store service 

18 6/59 ..Checkout counter 

l 86 /6l ...With means enabling price reading 

235/382 (0 OR, 4 XR) 

91S/375 SY^EMfcONTROLLED BY DATA BEARING RECORDS 

235/380 .Credit or identification card systems 

235/382 ..Permitting access 

235/492 (0 OR, 4 XR) 

Class 235 : REGISTERS 
235/487 RECORDS 
235/492 .Conductive 

379/114 15 (0 OR, 4 XR) 

179 • TELEPHONIC COMMUNICATIONS 
379/111 ' WITH USAGE MEASUREMENT (E.G., CALL OR TRAFFIC 

REGISTER) 

379/114.01 .Call charge metering or monitoring 
379/114.15 . .Calling card 

379/114 17 (0 OR, 4 XR) 

Class 379 : TELEPHONIC COMMUNICATIONS ^^yr 
379/111 WITH USAGE MEASUREMENT (E.G., CALL OR TRAFFIC 

REGISTER) 

379/114.01 .Call charge metering or monitoring 
179/114 15 ..Calling card ' 
379/114 '.17 ...Monitoring account or card usage balance 
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4 379/114.19 (0 OR, 4 XR) 

Class 37 9 : TELEPHONIC COMMUNICATIONS 

379/111 WITH USAGE MEASUREMENT (E.G., CALL OR TRAFFIC 

REGISTER) 

379/114.01 .Call charge metering or monitoring 
379/114.15 . .Calling card 
379/114.19 ...Credit card 

4 379/91.01 (0 OR, 4 XR) 

Class 37 9 ■ TELEPHONIC COMMUNICATIONS 

37 9/90 01 TELEPHONE LINE OR SYSTEM COMBINED WITH DIVERSE 

ELECTRICAL SYSTEM OR SIGNALLING (E.G., COM 

POSITE) 

379/91.01 .Credit authorizatxon 

3 235/376 (0 OR, 3 XR) 

Class 235 : REGISTERS 

235/375 SYSTEMS CONTROLLED BY DATA BEARING RECORDS 

235/376 .Operations analysis 

3 235/475 (0 OR, 3 XR) 

Class 235 : REGISTERS 

235/435 CODED RECORD SENSORS 

235/475 .Feed mechanisms 

3 705/16 (1 OR, 2 XR) 

Class 705 • DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/PRICE DETERMIN 

ATI0N 705/1 AUTOMATED ELECTRICAL FINANCIAL OR BUSINESS 

PRACTICE OR MANAGEMENT ARRANGEMENT 
705/16 .Including point of sale terminal or electroni 

c 

cash register 

3 705/44 (2 OR, 1 XR) 

Class 705 • DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/PRICE DETERMIN 

ATION 

705/1 AUTOMATED ELECTRICAL FINANCIAL OR BUSINESS 

PRACTICE OR MANAGEMENT ARRANGEMENT 
705/35 .Finance (e.g., banking, investment or credit) 

705/39 ..Including funds transfer or credit 

transaction 

705/44 ...Requiring authorization or authentication 

3 705/5 (1 OR, 2 XR) 
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Class 705 • DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/PRICE DETERMIN 

705/! AUTOMATED ELECTRICAL FINANCIAL OR BUSINESS 

PRACTICE OR MANAGEMENT ARRANGEMENT 
705/5 .Reservation, check-in, or booking display for 

reserved space 

705/53 (0 OR, 3 XR) 

Class 705 : DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/PRICE DETERMIN 

705/50 BUSINESS PROCESSING USING CRYPTOGRAPHY 

705/51 .Usage protection of distributed data files 

705/52 ..Usage or charge determination 

705/53 ...Including third party for collecting or 

distributing payment (e.g., clearinghouse) 

705/73 (1 OR, 2 XR) 

Class 705 : DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST /PRICE DETERMIN 



AT I ON 



705/50 BUSINESS PROCESSING USING CRYPTOGRAPHY 

705/64 .Secure transaction (e.g., EFT/POS) 

705/73 ..Terminal detail (e.g., initializing) 

141/94 (1 OR, 1 XR) 

Class 141 : FLUENT MATERIAL HANDLING, WITH RECEIVER OR 

RECEIVER COACTING MEANS 
141/94 WITH SIGNAL, INDICATOR, RECORDER, INSPECTION 

MEANS OR EXHIBITOR 

177/25.15 (1 OR, 1 XR) 

Class 177 : WEIGHING SCALES 

177/25.11 COMPUTER 

177/25.12 .Electrical 

177/25.13 ..Digital 

177/25.14 ...Multiplying or dividing scales 

177/25.15 ....Price 

235/377 (0 OR, 2 XR) 

Class 235 : REGISTERS 

235/375 SYSTEMS CONTROLLED BY DATA BEARING RECORDS 

235/377 .Time analysis 

235/381 (0 OR, 2 XR) 

Class 235 : REGISTERS 

235/375 SYSTEMS CONTROLLED BY DATA BEARING RECORDS 
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235/380 
235/381 



235/382.5 

Class 235 
235/375 
235/380 
235/382 
235/382.5 
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.Credit or identification card systems 

. .With vending 

(0 OR, 2 XR) 

: REGISTERS 

SYSTEMS CONTROLLED BY DATA BEARING RECORDS 
.Credit or identification card systems 
..Permitting access 
...Changeable authorization 



235/439 (0 OR, 2 XR) 

Class 235 : REGISTERS 

235/435 CODED RECORD SENSORS 

235/439 .Particular sensor structure 

235/449 (2 OR, 0 XR) 

Class 235 : REGISTERS 
235/435 CODED RECORD SENSORS 

235/439 .Particular sensor structure 

235/449 ..Magnetic 



235/462.45 

Class 235 
235/435 
235/439 
235/454 
235/462.01 
235/462.43 
235/462.45 



(0 OR, 2 XR) 

REGISTERS 
CODED RECORD SENSORS 
Particular sensor structure 

. Optical 
. . Bar code 

...Specified housing or mounting detail 
Hand-held (e.g., portable) 



235/486 (0 OR, 2 XR) 

Class 235 : REGISTERS 

235/435 CODED RECORD SENSORS 

235/486 .Holding devices 

235/493 (0 OR, 2 XR) 

Class 235 : REGISTERS 
235/487 RECORDS 
235/493 .Magnetic 

271/902 (0 OR, 2 XR) 

Class 271 • SHEET FEEDING OR DELIVERING 
271/902 REVERSE DIRECTION OF SHEET MOVEMENT 



341/23 

Class 

341/20 

341/22 



(0 OR, 2 XR) 
341 : CODED DATA GENERATION OR CONVERSION 
BODILY ACTUATED CODE GENERATOR 
.Including keyboard or keypad 
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341 /23 ..Variable key legends 

355/40 (2 OR, 0 XR) 

Class 355 : PHOTOCOPYING 

355/18 PROJECTION PRINTING AND COPYING CAMERAS 

355/40 .Identifying, composing, or selecting 

379/114.01 (0 OR, 2 XR) 

Class 37 9 ■ TELEPHONIC COMMUNICATIONS 

37 9/111 WITH USAGE MEASUREMENT (E.G., CALL OR TRAFFIC 

REGISTER) 

379/114.01 .Call charge metering or monitoring 

379/115.01 (2 OR, 0 XR) 

Class 379 : TELEPHONIC COMMUNICATIONS 

379/111 WITH USAGE MEASUREMENT (E.G., CALL OR TRAFFIC 

REGISTER) 

379/114.01 .Call charge metering or monitoring 
379/115*.01 . . Interexchange billing operation 

379/157 (1 OR, 1 XR) 

Class 379 • TELEPHONIC COMMUNICATIONS 

379/156 ' MULTI-LINE OR KEY SUBSTATION SYSTEM WITH 

SELECTIVE SWITCHING AND CENTRAL SWITCHING 

CE CONNECTION 

379/157 .With special service 

379/201.02 (1 OR, 1 XR) 

Class 37 9 : TELEPHONIC COMMUNICATIONS 
379/201.01 SPECIAL SERVICES , 
379/201.02 .Service profile (e.g., calling service) 

379/242 (1 OR, 1 XR) 

Class 37 9 : TELEPHONIC COMMUNICATIONS 
379/242 CENTRALIZED SWITCHING SYSTEM 

379/260 (0 OR, 2 XR) 

Class 37 9 • TELEPHONIC COMMUNICATIONS 

37 9/242 CENTRALIZED SWITCHING SYSTEM 

379/258 .Switching controlled in response to called 

station addressing signal 
379/260 ..With operator position or completion of call 

(e.g., dial "O", semiautomatic) 

379/88.24 (0 OR, 2 XR) 

Class 379 : TELEPHONIC COMMUNICATIONS 

379/67.1 AUDIO MESSAGE STORAGE, RETRIEVAL, OR SYNTHESIS 
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379/88.22 
379/88.23 
379/88.24 



.Message management 

..Controlled by subscriber or caller 
. . .By generated tone 



379/91.02 (1 OR, 1 XR) 

Class 379 : TELEPHONIC COMMUNICATIONS 

371/90 01 TELEPHONE LINE OR SYSTEM COMBINED WITH DIVERSE 

ELECTRICAL SYSTEM OR SIGNALLING (E.G., CO 



MPOSITE) 



379/91.01 
379/91.02 



.Credit authorization 
. .At switching station 



2 379/93.14 
Class 
379/90.01 



(0 OR, 2 XR) 
37 9 • TELEPHONIC COMMUNICATIONS 

TELEPHONE LINE OR SYSTEM COMBINED WITH DIVERSE 
ELECTRICAL SYSTEM OR SIGNALLING (E.G., CO 



MPOSITE) 



379/93.01 



379/93.14 



.Having transmission of a digital message 

signal over a telephone line 
..Having switching station 



2 400/73 

Class 
400/70 



TROL 



400/73 



2 705/21 

Class 



AT I ON 



705/1 
705/16 



705/21 



computer (e.g., 
m host to ECR or 



(0 OR, 2 XR) 
400 ■ TYPEWRITING MACHINES 

INCLUDING SELECTION OF TYPE-FACE BY 

PROGRAMMED-CONTROL-SYSTEM OR BY REMOTE CON 

.Including particular reader structure and 
operation 

(2 OR, 0 XR) 
705 • DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/PRICE DETERMIN 

AUTOMATED ELECTRICAL FINANCIAL OR BUSINESS 

PRACTICE OR MANAGEMENT ARRANGEMENT 
.Including point of sale terminal or electron! 

cash register 
Interconnection or interaction of plural 
electronic cash registers (ECRs) or to host 

network detail, transfer of information fro 
from ECR to ECR, etc.) 



2 705/23 

Class 



(1 OR, 1 XR) 
7 05 : DATA PROCESSING: 
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AT I ON 
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PRACTICE7 MANAGEMENT, OR COST/PRICE DETERMIN 

705 /i AUTOMATED ELECTRICAL FINANCIAL OR BUSINESS 

PRACTICE OR MANAGEMENT ARRANGEMENT 
705/16 .Including point of sale terminal or electroni 

cash register 

705/23 ..Input by product or record sensing (weighing 

scanner processing) 

705/41 (1 OR, 1 XR) 

Class 705 • DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST /PRICE DETERMIN 

705/1 AUTOMATED ELECTRICAL FINANCIAL OR BUSINESS 

PRACTICE OR MANAGEMENT ARRANGEMENT 
705/35 .Finance (e.g., banking, investment or credit) 

705/39 ..Including funds transfer or credit 

transaction 



705/41 ...Having programming of a portable memory 

device (e.g., IC card, "electronic purse" 



) 



2 705/410 (1 OR, 1 XR) 

Class 705 : DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/PRICE DETERMIN 

AT I ON 

705/400 FOR COST/PRICE 

705/401 .Postage meter system 

705/410 ..Specialized function performed 

2 705/57 (1 OR, 1 XR) 

Class 705 • DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/PRICE DETERMIN 

AT TON 

705/50 BUSINESS PROCESSING USING CRYPTOGRAPHY 

705/51 .Usage protection of distributed data files 

705/57 ..Copy protection or prevention 

2 705/71 (2 OR, 0 XR) 

Class 705 • DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/PRICE DETERMIN 

AT TON 

705/50 BUSINESS PROCESSING USING CRYPTOGRAPHY 

705/64 .Secure transaction (e.g., EFT/POS) 

705/71 ..Including key management 
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2 705/8 (0 OR, 2 XR) 

Class 705 : DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/PRICE DETERMIN 

AT ION 

705/1 AUTOMATED ELECTRICAL FINANCIAL OR BUSINESS 

PRACTICE OR MANAGEMENT ARRANGEMENT 
705/7 .Operations research 

705/8 ..Allocating resources or scheduling for an 

administrative function 

2 705/80 (1 OR, 1 XR) 

Class 705 : DATA PROCESSING: FINANCIAL, BUSINESS 

PRACTICE, MANAGEMENT, OR COST/ PRICE DETERMIN 

AT I ON 

705/80 ELECTRONIC NEGOTIATION 

2 707/104.1 (1 OR, 1 XR) 

Class 707 : DATA PROCESSING: DATABASE AND FILE 

MANAGEMENT, DATA STRUCTURES, OR DOCUMENT P 

ROCESSING 

7 07/100 DATABASE SCHEMA OR DATA STRUCTURE 

707/104.1 .Application of database or data structure 

(e.g., distributed, multimedia, image) 

2 709/224 (2 OR, 0 XR) 

Class 709 : ELECTRICAL COMPUTERS AND DIGITAL PROCESSING 

SYSTEMS: MULTIPLE COMPUTER OR PROCESS COO 

RDINATING 

709/200 MULTICOMPUTER DATA TRANSFERRING 

709/223 .Computer network managing 

709/224 ..Computer network, monitoring 

2 709/237 (2 OR, 0 XR) 

Class 709 : ELECTRICAL COMPUTERS AND DIGITAL PROCESSING 

SYSTEMS: MULTIPLE COMPUTER OR PROCESS COO 

RDINATING 

709/200 MULTICOMPUTER DATA TRANSFERRING 

709/230 .Computer-to-computer protocol implementing 

709/237 ..Computer-to-computer handshaking 

2 714/7 (1 OR, 1 XR) 

Class 714 : ERROR DETECTION/CORRECTION AND FAULT 

DETECTION/RECOVERY 
714/100 DATA PROCESSING SYSTEM ERROR OR FAULT HANDLING 



714/1 
714/2 
714/3 



availability 
reconfiguration 



094 8338 6_CLSTITLES 
714/5 ....Of memory or peripheral subsystem 

714/6 Redundant stored data accessed (e.g., 

duplicated data, error correction coded da 

, or other 

parity-type data) 

714/7 Reconfiguration (e.g., adding a 

replacement storage component) 

2 902/22 (0 OR, 2 XR) 

Class 902 : ELECTRONIC FUNDS TRANSFER 

902/22 TERMINAL* REGISTERS TRANSACTION* (E.G., POINT 

OF SALE TERMINAL* ) 

2 902/26 (0 OR, 2 XR) 

Class 902 : ELECTRONIC FUNDS TRANSFER 

902/25 SPECIFIC IDENTIFIER* (E.G., BANK CARD) 

902/26 .Including semiconductor chip (e.g., smart 

card) 

2 902/40 (0 OR, 2 XR) 

Class 902 : ELECTRONIC FUNDS TRANSFER 

902/37 SYSTEM* 

902/40 .Transaction* processing 

2 902/5 (0 OR, 2 XR) 

Class 902 : ELECTRONIC FUNDS TRANSFER 

902/1 WITH ELECTRONIC MEANS PROVIDING SECURITY 

902/4 .Means to read data stored on identifier* 

902/5 • .And to verify identity of user* 
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